mcp 0.5.0 tool execution happens in agent process context with zero isolation
tested this with two tools in the same agent instance. tool A writes sensitive data to /tmp, tool B can read it. both tools share env vars, filesystem, network stack, everything. this means if you have multi-tenant agents (we do) there's zero isolation between tenants. tenant A can poison the filesystem or env for tenant B. are we supposed to run separate agent processes per tenant? that doesn't scale. what's the deployment model here
wait so every tool just inherits the agent's permissions? no capability model, no scoping, nothing? this is worse than docker without user namespaces
is worse than docker without user namespaces because at least docker has some isolation from host. this is just zero sandbox, everything runs as same user
1. tested this yesterday with two different tools running simultaneously 2. both tools have full filesystem access, no scoping, no sandboxing 3. tool A can read files written by tool B with zero isolation
wait so if i deploy this in prod every tool just runs as whatever user the agent process is running as? no capability model, no sandboxing, nothing?
tested this tuesday, can confirm zero sandboxing